diff options
| author | Trevor Perrin <unsafe@trevp.net> | 2013-09-13 19:32:55 -0700 |
|---|---|---|
| committer | Trevor Perrin <unsafe@trevp.net> | 2013-09-13 19:32:55 -0700 |
| commit | c655f40ed2eb291adf3e23264b7535b7487efe50 (patch) | |
| tree | b8b94c033ef67c8273b2e31765b9c7f38be12d8e /ssl/ssl_rsa.c | |
| parent | 9103197591150bb0d8641a26e79cccdc4b514697 (diff) | |
Require ServerInfo PEMs to be named "BEGIN SERVERINFO FOR"...
Diffstat (limited to 'ssl/ssl_rsa.c')
| -rw-r--r-- | ssl/ssl_rsa.c | 16 |
1 files changed, 14 insertions, 2 deletions
diff --git a/ssl/ssl_rsa.c b/ssl/ssl_rsa.c index b6765a30e1..36d7a1a819 100644 --- a/ssl/ssl_rsa.c +++ b/ssl/ssl_rsa.c @@ -982,6 +982,7 @@ int SSL_CTX_use_serverinfo_file(SSL_CTX *ctx, const char *file) long extension_length = 0; char* name = NULL; char* header = NULL; + char namePrefix[] = "SERVERINFO FOR "; int ret = 0; BIO *bin = NULL; size_t num_extensions = 0; @@ -1017,11 +1018,22 @@ int SSL_CTX_use_serverinfo_file(SSL_CTX *ctx, const char *file) else /* End of file, we're done */ break; } + /* Check that PEM name starts with "BEGIN SERVERINFO FOR " */ + if (strlen(name) < strlen(namePrefix)) + { + SSLerr(SSL_F_SSL_CTX_USE_SERVERINFO_FILE, ERR_R_PEM_LIB); + goto end; + } + if (strncmp(name, namePrefix, strlen(namePrefix)) != 0) + { + SSLerr(SSL_F_SSL_CTX_USE_SERVERINFO_FILE, ERR_R_PEM_LIB); + goto end; + } /* Check that the decoded PEM data is plausible (valid length field) */ if (extension_length < 4 || (extension[2] << 8) + extension[3] != extension_length - 4) { - SSLerr(SSL_F_SSL_CTX_USE_SERVERINFO_FILE, ERR_R_PEM_LIB); - goto end; + SSLerr(SSL_F_SSL_CTX_USE_SERVERINFO_FILE, ERR_R_PEM_LIB); + goto end; } /* Append the decoded extension to the serverinfo buffer */ serverinfo = OPENSSL_realloc(serverinfo, serverinfo_length + extension_length); |